Box Bear Digital Limited (hereafter referred to as “Box Bear”, “we, “us”) use your personal data to provide our video and animation services to you and/or your business. We describe how we collect, store and use your data in this Privacy Policy.

We take seriously our responsibilities to look after your data and we are committed to protecting your privacy. There are steps you can take to control what we do with your data and we have explained those steps in this Privacy Policy.

When we talk about data and personal data in this Privacy Policy, we mean personal data which identify you or which could be used to identify you such as your name and contact details and images of you within videos and photography.

1. Who is responsible for your data

Box Bear is responsible for your data. Our registered address is Technology House, 10 Pinehill Road, Crowthorne, RG45 7JD. We are registered as a company in England and Wales under company number 09926138. We are the data controller of the data which we collect from you, and as such we control the ways your personal data are collected and the purposes for which your personal data are used. We are data processors for the data we hold within footage that is captured as part of a production.

2. Personal data we collect about you

Depending on how you use our services and our websites, we might collect the following kinds of information about you:

3. Sensitive Personal Data

Certain kinds of personal data, such as data about your racial or ethnic origin, your physical or mental health, conviction of criminal offences are special categories of personal data which by law require additional protection. We try to limit the circumstances in which we collect sensitive personal data of this kind, but we do collect and process it under such circumstances including but not limited to:

• You are a member of staff
• You are a freelancer, actor or a crew member working for us
• We are required to in order to deliver the services to you.

4. How we use your personal data

We can only use your personal data if we have a proper reason for doing so. According to the law, we can only use your data for one or more of these reasons:

• To fulfil a contract we have with you, or
• When you consent to it, or
• When it is in our legitimate interests where legitimate interests are our business or commercial reasons for using your data, but even so, we will not unfairly put our legitimate interests above what is best for you.

In the table below, we have set out the different ways in which we use your personal data and the reasons we rely on for using that data.

If we rely on our legitimate interests for using your personal data, we will explain that to you.

5. How we process your data

When video footage and files are captured of an individual their consent to process the data will be gathered via a consent form supplied by you to us granting us consent from the individual to process their data. This consent will be given by the individual for the processing of the footage to create the project as specified. Each use for the footage must be specified. Any future uses of the footage requiring new processing of the data for a different purpose or project will require additional consent.

This consent must be freely given, specific, informed and unambiguous and is the joint responsibility of Box Bear and you to gather.

At the time of obtaining consent, individuals are made aware that they are able to withdraw consent at any time but also that this would not render processing prior to withdrawal to be unlawful.

DreamingFish and our clients may have a legitimate interest to continue to use and process personal data even if an individual has withdrawn their consent for the business to do so including but not limited to:

1. i)  where there is a real business interest being pursued in continuing to process the personal data;
2. ii)  the processing is absolutely necessary in order for you to pursue that interest (i.e. the interest cannot be pursued in another way which is proportionate); and

iii)  the processing is balanced against the impact such processing will have on the fundamental rights and freedoms of data subjects.

In considering whether or not it is proportionate and legitimate for a business to continue using video footage which contains imagery of an identifiable individual the following factors will be considered:

• Where will the footage be used?
• Is the individual a main part of the footage?
• Does the footage indicate that the individual has links or associations with people or a particular ideology which he no longer does?
• What is the likely impact of continuing to use the footage on that individual?
• What is the impact on the business?

6. How long we keep your data

We keep your data only for as long as we need it. How long we need data depends on what we are using it for, whether that is to provide services to you, for our own legitimate interests (described above) or so that we can comply with the law.

We will actively review the information we hold and when there is no longer a customer, legal or business need for us to hold it, we will either delete it securely or in some cases anonymise it.

Raw, un processed video footage and files will be stored for a maximum of 2 years unless otherwise agreed with you.

7. How we protect your data

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction.

We use technical measures such as but not limited to encryption and password protection to protect your data and the systems they are held in. We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which information is held.

8. Sharing your data

We may share your data with staff and sub-contractors who are fulfilling a specialist role within the production. For example but not limited to production staff, animators, actors, AV crew and drone operators. We will make sure that our suppliers respect your personal data and comply with data protection laws. We also sometimes have to provide your personal data to government authorities including HMRC and HSE to fulfil our legal obligations.

9. Your rights

You are entitled to see copies of all personal data held by us and to amend, correct or delete such data. You can also limit, restrict or object to the processing of your data.

If you gave us your consent to use your data so that we can send you marketing emails, you can withdraw your consent. Please note that even if you withdraw your consent, we can still rely on the consent you gave as the lawful basis for processing your data before you withdrew your consent.

You can object to our use of your data where we rely on our legitimate interests to do so. We explained the legitimate interests we rely in the table above under the heading ‘How we use your personal data’.

To raise any objections or to exercise any of your rights, you can send an email to us at email@boxbear.co.uk or you can write to us at Data Protection, Box Bear Digital Limited, Technology House, 10 Pinehill Road, Crowthorne, RG45 7JD.

When you get in touch, we will come back to you as soon as possible and where possible within one month. If your request is more complicated, it may take a little longer to come back to you but we will come back to you within two months of your request. There is no charge for most requests, but if you ask us to provide a significant amount of data for example we may ask you to pay a reasonable admin fee. We may also ask you to verify your identity before we provide any information to you.

Last updated 25 January 2021